feat: add cmk:test-resources, cmk:rust, cmk:testcontainers; harden cmk:cicd

[daniellam258]

Summary

• New skill cmk:test-resources: designing safe, expensive-resource sharing (containers, databases, external services) across a test suite under a parallel runner. Core teaching: verify the runner's real process model (nextest executes each test as its own process) before assuming an in-process static singleton actually shares anything; the two valid shapes once that's known (in-process singleton vs. one externally-started resource namespaced per consumer); namespacing must compose a process-unique discriminator with any per-call counter, since a counter alone only disambiguates within its own process.
• New skill cmk:rust: apply idiomatic Rust practices inside a crate whose shape the design already decided (cmk:project-layout owns crate placement; this starts one level in). Five facets, each split into a references/ file: module boundaries (public-surface convention), error handling (three legitimate shapes — typed/propagated, boundary/opaque, plain classification data), feature flags (default-off, whole-subsystem gating, mechanically computed feature union), build/test/lint wiring (toolchain pin, nextest's process-per-test implications, one layer for lint strictness), and dependency hygiene (policy scanner vs. hand-written graph assertions — neither substitutes for the other).
• New skill cmk:testcontainers: the Rust/testcontainers-crate-specific mechanics layered under both of the above — bounded retry/backoff around container startup, bundling the container guard's Drop-driven lifetime inside whatever struct carries connection info, always reading back host/port, and treating cmk:test-resources' two sharing shapes as alternatives, never both at once.
• Hardens cmk:cicd:
  • speedup misattribution — a multi-part CI change that cuts wall-clock gets every part credited for the win unless it's traced to the specific mechanism that produced it; a real win from one part can fully mask an inert sibling part. Cross-linked both directions with cmk:test-resources, which is the same principle one layer down.
  • group build variants instead of rebuilding the workspace per variant — a check that would otherwise run once per feature combination, target, or lint pass pays a full workspace compile that many times over; compute the union of what needs checking and cover it in one pass, reserving a second pass only for a proof the grouped one genuinely can't express. Cross-linked to cmk:rust's computed-feature-union mechanic.
• Updated docs/ai/skills/ self-documentation (README roster, family listing, conventions.md bookkeeping, new test-resources.md/rust.md/testcontainers.md, cicd.md refresh) to match, and every new skill follows the setup-family shape (## Modes + report-only ## Verify).

Distilled from a real incident: a session's entire "shared testcontainer per test binary" optimization effort silently contributed zero benefit for two packages, because nextest's process-per-test execution model meant the in-process statics never persisted across tests — the measured CI speedup was real but came entirely from an unrelated, pre-existing mechanism. A second bug (ordinal-only database naming colliding across processes once correctly routed to a real shared server) motivated the namespacing guidance. The Rust-structure and CI-build-grouping content generalizes patterns observed while doing that work, checked against the codebase's actual (not aspirational) practice.

Test plan

• bash scripts/skill-lint.sh passes (frontmatter, size budget, reference integrity, citations, cross-package paths)
• Every touched/new SKILL.md stays within the 150-line budget (41–104 lines)
• No product/repo-specific vocabulary in skills/ (kit's genericity bar)
• Every new setup-family skill has both a ## Modes and a report-only ## Verify section